Skip to content
OpenAdvisories

Weakness (CWE)

CWE-179: Incorrect Behavior Order: Early Validation

Base Incomplete

The product validates input before applying protection mechanisms that modify the input.

How to prevent it (1 mitigation)

  1. Implementation

    Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

Source: MITRE CWE-179

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-3832

    Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response

    A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP response…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Alpine
  • Low 3.8
    GHSA-h39g-6x3c-7fq9

    Zio has SubFileSystem Path Confinement Bypass via Unresolved `..` Segment

    # Summary `SubFileSystem` fails to confine operations to its declared sub path when the input path is `/../` (or equivalents `/../`, `/..\\`). This path passes all validation but resolves to the root of the parent filesystem, allowing directory level operatio…

    Zio NuGet